@labacacia/nps-sdk 1.0.0-alpha.1 → 1.0.0-alpha.13

package/dist/ndp/frames.js

@@ -9,9 +9,23 @@ export class AnnounceFrame {
     timestamp;
     signature;
     nodeType;
+    node_roles;
+    cluster_anchor;
+    spawn_spec_ref;
+    bridge_protocols;
+    activation_mode;
+    activation_endpoint;
+    heartbeat_interval_ms;
+    health;
+    last_seen;
     frameType = FrameType.ANNOUNCE;
     preferredTier = EncodingTier.MSGPACK;
-    constructor(nid, addresses, capabilities, ttl, timestamp, signature, nodeType) {
+    constructor(nid, addresses, capabilities, ttl, timestamp, signature, nodeType, node_roles, cluster_anchor, spawn_spec_ref, // NDP v0.9 §3.1.1 schema
+    bridge_protocols, activation_mode, activation_endpoint, heartbeat_interval_ms = 60_000, // NDP v0.9 §3.1
+    // NDP v0.9 liveness — wire-only, EXCLUDED from the signed canonical form
+    // (last_seen updates every heartbeat → must not require re-signing; §3.2.1).
+    health, // "healthy" / "degraded" / "draining"
+    last_seen) {
         this.nid = nid;
         this.addresses = addresses;
         this.capabilities = capabilities;
@@ -19,6 +33,15 @@ export class AnnounceFrame {
         this.timestamp = timestamp;
         this.signature = signature;
         this.nodeType = nodeType;
+        this.node_roles = node_roles;
+        this.cluster_anchor = cluster_anchor;
+        this.spawn_spec_ref = spawn_spec_ref;
+        this.bridge_protocols = bridge_protocols;
+        this.activation_mode = activation_mode;
+        this.activation_endpoint = activation_endpoint;
+        this.heartbeat_interval_ms = heartbeat_interval_ms;
+        this.health = health;
+        this.last_seen = last_seen;
     }
     unsignedDict() {
         return {
@@ -28,13 +51,26 @@ export class AnnounceFrame {
             ttl: this.ttl,
             timestamp: this.timestamp,
             node_type: this.nodeType ?? null,
+            node_roles: this.node_roles ?? null,
+            cluster_anchor: this.cluster_anchor ?? null,
+            spawn_spec_ref: this.spawn_spec_ref ?? null,
+            bridge_protocols: this.bridge_protocols ?? null,
+            activation_mode: this.activation_mode ?? null,
+            activation_endpoint: this.activation_endpoint ?? null,
+            heartbeat_interval_ms: this.heartbeat_interval_ms,
         };
     }
     toDict() {
-        return { ...this.unsignedDict(), signature: this.signature };
+        const d = { ...this.unsignedDict(), signature: this.signature };
+        // Liveness fields live on the wire only (not in unsignedDict → not signed).
+        if (this.health !== undefined)
+            d["health"] = this.health;
+        if (this.last_seen !== undefined)
+            d["last_seen"] = this.last_seen;
+        return d;
     }
     static fromDict(data) {
-        return new AnnounceFrame(data["nid"], data["addresses"], data["capabilities"], data["ttl"], data["timestamp"], data["signature"], data["node_type"] ?? undefined);
+        return new AnnounceFrame(data["nid"], data["addresses"], data["capabilities"], data["ttl"], data["timestamp"], data["signature"], data["node_type"] ?? undefined, (data["node_roles"] ?? data["node_kind"]) ?? undefined, data["cluster_anchor"] ?? undefined, data["spawn_spec_ref"] ?? undefined, data["bridge_protocols"] ?? undefined, data["activation_mode"] ?? undefined, data["activation_endpoint"] ?? undefined, data["heartbeat_interval_ms"] ?? 60_000, data["health"] ?? undefined, data["last_seen"] ?? undefined);
     }
 }
 export class ResolveFrame {
@@ -60,28 +96,31 @@ export class ResolveFrame {
     }
 }
 export class GraphFrame {
-    seq;
-    initialSync;
+    graph_id;
     nodes;
-    patch;
+    edges;
+    ttl;
+    metadata;
     frameType = FrameType.GRAPH;
     preferredTier = EncodingTier.MSGPACK;
-    constructor(seq, initialSync, nodes, patch) {
-        this.seq = seq;
-        this.initialSync = initialSync;
+    constructor(graph_id, nodes, edges, ttl, metadata) {
+        this.graph_id = graph_id;
         this.nodes = nodes;
-        this.patch = patch;
+        this.edges = edges;
+        this.ttl = ttl;
+        this.metadata = metadata;
     }
     toDict() {
         return {
-            seq: this.seq,
-            initial_sync: this.initialSync,
-            nodes: this.nodes ?? null,
-            patch: this.patch ?? null,
+            graph_id: this.graph_id,
+            nodes: this.nodes,
+            edges: this.edges,
+            ttl: this.ttl,
+            metadata: this.metadata ?? null,
         };
     }
     static fromDict(data) {
-        return new GraphFrame(data["seq"], data["initial_sync"], data["nodes"] ?? undefined, data["patch"] ?? undefined);
+        return new GraphFrame(data["graph_id"], data["nodes"] ?? [], data["edges"] ?? [], data["ttl"], data["metadata"] ?? undefined);
     }
 }
 //# sourceMappingURL=frames.js.map

package/dist/ndp/frames.js.map

@@ -1 +1 @@
-{"version":3,"file":"frames.js","sourceRoot":"","sources":["../../src/ndp/frames.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,sCAAsC;AAEtC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAuB5D,MAAM,OAAO,aAAa;IAKN;IACA;IACA;IACA;IACA;IACA;IACA;IAVT,SAAS,GAAO,SAAS,CAAC,QAAQ,CAAC;IACnC,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC;IAE9C,YACkB,GAAoB,EACpB,SAAmC,EACnC,YAA+B,EAC/B,GAAoB,EACpB,SAAoB,EACpB,SAAoB,EACpB,QAAoB;QANpB,QAAG,GAAH,GAAG,CAAiB;QACpB,cAAS,GAAT,SAAS,CAA0B;QACnC,iBAAY,GAAZ,YAAY,CAAmB;QAC/B,QAAG,GAAH,GAAG,CAAiB;QACpB,cAAS,GAAT,SAAS,CAAW;QACpB,cAAS,GAAT,SAAS,CAAW;QACpB,aAAQ,GAAR,QAAQ,CAAY;IACnC,CAAC;IAEJ,YAAY;QACV,OAAO;YACL,GAAG,EAAW,IAAI,CAAC,GAAG;YACtB,SAAS,EAAK,IAAI,CAAC,SAAS;YAC5B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,EAAW,IAAI,CAAC,GAAG;YACtB,SAAS,EAAK,IAAI,CAAC,SAAS;YAC5B,SAAS,EAAK,IAAI,CAAC,QAAQ,IAAI,IAAI;SACpC,CAAC;IACJ,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAA6B;QAC3C,OAAO,IAAI,aAAa,CACtB,IAAI,CAAC,KAAK,CAAoB,EAC9B,IAAI,CAAC,WAAW,CAAoB,EACpC,IAAI,CAAC,cAAc,CAAa,EAChC,IAAI,CAAC,KAAK,CAAoB,EAC9B,IAAI,CAAC,WAAW,CAAc,EAC9B,IAAI,CAAC,WAAW,CAAc,EAC7B,IAAI,CAAC,WAAW,CAAsB,IAAI,SAAS,CACrD,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,YAAY;IAKL;IACA;IACA;IANT,SAAS,GAAO,SAAS,CAAC,OAAO,CAAC;IAClC,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC;IAE9C,YACkB,MAAqB,EACrB,YAAqB,EACrB,QAA+B;QAF/B,WAAM,GAAN,MAAM,CAAe;QACrB,iBAAY,GAAZ,YAAY,CAAS;QACrB,aAAQ,GAAR,QAAQ,CAAuB;IAC9C,CAAC;IAEJ,MAAM;QACJ,OAAO;YACL,MAAM,EAAS,IAAI,CAAC,MAAM;YAC1B,aAAa,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;YACxC,QAAQ,EAAO,IAAI,CAAC,QAAQ,IAAQ,IAAI;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAA6B;QAC3C,OAAO,IAAI,YAAY,CACrB,IAAI,CAAC,QAAQ,CAAmB,EAC/B,IAAI,CAAC,eAAe,CAAmB,IAAI,SAAS,EACpD,IAAI,CAAC,UAAU,CAAkC,IAAI,SAAS,CAChE,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,UAAU;IAKH;IACA;IACA;IACA;IAPT,SAAS,GAAO,SAAS,CAAC,KAAK,CAAC;IAChC,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC;IAE9C,YACkB,GAAmB,EACnB,WAAoB,EACpB,KAAoC,EACpC,KAA+C;QAH/C,QAAG,GAAH,GAAG,CAAgB;QACnB,gBAAW,GAAX,WAAW,CAAS;QACpB,UAAK,GAAL,KAAK,CAA+B;QACpC,UAAK,GAAL,KAAK,CAA0C;IAC9D,CAAC;IAEJ,MAAM;QACJ,OAAO;YACL,GAAG,EAAW,IAAI,CAAC,GAAG;YACtB,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,KAAK,EAAS,IAAI,CAAC,KAAK,IAAI,IAAI;YAChC,KAAK,EAAS,IAAI,CAAC,KAAK,IAAI,IAAI;SACjC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAA6B;QAC3C,OAAO,IAAI,UAAU,CACnB,IAAI,CAAC,KAAK,CAAoB,EAC9B,IAAI,CAAC,cAAc,CAAY,EAC9B,IAAI,CAAC,OAAO,CAA2B,IAAI,SAAS,EACpD,IAAI,CAAC,OAAO,CAAsC,IAAI,SAAS,CACjE,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"frames.js","sourceRoot":"","sources":["../../src/ndp/frames.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,sCAAsC;AAEtC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AA6B5D,MAAM,OAAO,aAAa;IAKN;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAGA;IACA;IArBT,SAAS,GAAO,SAAS,CAAC,QAAQ,CAAC;IACnC,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC;IAE9C,YACkB,GAA4B,EAC5B,SAA2C,EAC3C,YAAuC,EACvC,GAA4B,EAC5B,SAA4B,EAC5B,SAA4B,EAC5B,QAA4B,EAC5B,UAA8B,EAC9B,cAA4B,EAC5B,cAA6C,EAAE,yBAAyB;IACxE,gBAA8B,EAC9B,eAA4B,EAC5B,mBAA4B,EAC5B,wBAAgC,MAAM,EAAE,gBAAgB;IACxE,yEAAyE;IACzE,6EAA6E;IAC7D,MAA4B,EAAE,sCAAsC;IACpE,SAA4B;QAjB5B,QAAG,GAAH,GAAG,CAAyB;QAC5B,cAAS,GAAT,SAAS,CAAkC;QAC3C,iBAAY,GAAZ,YAAY,CAA2B;QACvC,QAAG,GAAH,GAAG,CAAyB;QAC5B,cAAS,GAAT,SAAS,CAAmB;QAC5B,cAAS,GAAT,SAAS,CAAmB;QAC5B,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,eAAU,GAAV,UAAU,CAAoB;QAC9B,mBAAc,GAAd,cAAc,CAAc;QAC5B,mBAAc,GAAd,cAAc,CAA+B;QAC7C,qBAAgB,GAAhB,gBAAgB,CAAc;QAC9B,oBAAe,GAAf,eAAe,CAAa;QAC5B,wBAAmB,GAAnB,mBAAmB,CAAS;QAC5B,0BAAqB,GAArB,qBAAqB,CAAiB;QAGtC,WAAM,GAAN,MAAM,CAAsB;QAC5B,cAAS,GAAT,SAAS,CAAmB;IAC3C,CAAC;IAEJ,YAAY;QACV,OAAO;YACL,GAAG,EAAmB,IAAI,CAAC,GAAG;YAC9B,SAAS,EAAa,IAAI,CAAC,SAAS;YACpC,YAAY,EAAU,IAAI,CAAC,YAAY;YACvC,GAAG,EAAmB,IAAI,CAAC,GAAG;YAC9B,SAAS,EAAa,IAAI,CAAC,SAAS;YACpC,SAAS,EAAa,IAAI,CAAC,QAAQ,IAAe,IAAI;YACtD,UAAU,EAAY,IAAI,CAAC,UAAU,IAAc,IAAI;YACvD,cAAc,EAAQ,IAAI,CAAC,cAAc,IAAU,IAAI;YACvD,cAAc,EAAQ,IAAI,CAAC,cAAc,IAAU,IAAI;YACvD,gBAAgB,EAAM,IAAI,CAAC,gBAAgB,IAAQ,IAAI;YACvD,eAAe,EAAQ,IAAI,CAAC,eAAe,IAAW,IAAI;YAC1D,mBAAmB,EAAI,IAAI,CAAC,mBAAmB,IAAO,IAAI;YAC1D,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,CAAC;IACJ,CAAC;IAED,MAAM;QACJ,MAAM,CAAC,GAA4B,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACzF,4EAA4E;QAC5E,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QACzD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,CAAC,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAClE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAA6B;QAC3C,OAAO,IAAI,aAAa,CACtB,IAAI,CAAC,KAAK,CAA4B,EACtC,IAAI,CAAC,WAAW,CAA4B,EAC5C,IAAI,CAAC,cAAc,CAAqB,EACxC,IAAI,CAAC,KAAK,CAA4B,EACtC,IAAI,CAAC,WAAW,CAAsB,EACtC,IAAI,CAAC,WAAW,CAAsB,EACrC,IAAI,CAAC,WAAW,CAA8B,IAAI,SAAS,EAC3D,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,CAAqB,IAAI,SAAS,EAC1E,IAAI,CAAC,gBAAgB,CAAyB,IAAI,SAAS,EAC3D,IAAI,CAAC,gBAAgB,CAA4C,IAAI,SAAS,EAC9E,IAAI,CAAC,kBAAkB,CAA2B,IAAI,SAAS,EAC/D,IAAI,CAAC,iBAAiB,CAA0B,IAAI,SAAS,EAC7D,IAAI,CAAC,qBAAqB,CAAsB,IAAI,SAAS,EAC7D,IAAI,CAAC,uBAAuB,CAAoB,IAAI,MAAM,EAC1D,IAAI,CAAC,QAAQ,CAAmC,IAAI,SAAS,EAC7D,IAAI,CAAC,WAAW,CAAgC,IAAI,SAAS,CAC/D,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,YAAY;IAKL;IACA;IACA;IANT,SAAS,GAAO,SAAS,CAAC,OAAO,CAAC;IAClC,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC;IAE9C,YACkB,MAAqB,EACrB,YAAqB,EACrB,QAA+B;QAF/B,WAAM,GAAN,MAAM,CAAe;QACrB,iBAAY,GAAZ,YAAY,CAAS;QACrB,aAAQ,GAAR,QAAQ,CAAuB;IAC9C,CAAC;IAEJ,MAAM;QACJ,OAAO;YACL,MAAM,EAAS,IAAI,CAAC,MAAM;YAC1B,aAAa,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;YACxC,QAAQ,EAAO,IAAI,CAAC,QAAQ,IAAQ,IAAI;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAA6B;QAC3C,OAAO,IAAI,YAAY,CACrB,IAAI,CAAC,QAAQ,CAAmB,EAC/B,IAAI,CAAC,eAAe,CAAmB,IAAI,SAAS,EACpD,IAAI,CAAC,UAAU,CAAkC,IAAI,SAAS,CAChE,CAAC;IACJ,CAAC;CACF;AAUD,MAAM,OAAO,UAAU;IAKH;IACA;IACA;IACA;IACA;IART,SAAS,GAAO,SAAS,CAAC,KAAK,CAAC;IAChC,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC;IAE9C,YACkB,QAAiB,EACjB,KAAkC,EAClC,KAAkC,EAClC,GAAiB,EACjB,QAAkC;QAJlC,aAAQ,GAAR,QAAQ,CAAS;QACjB,UAAK,GAAL,KAAK,CAA6B;QAClC,UAAK,GAAL,KAAK,CAA6B;QAClC,QAAG,GAAH,GAAG,CAAc;QACjB,aAAQ,GAAR,QAAQ,CAA0B;IACjD,CAAC;IAEJ,MAAM;QACJ,OAAO;YACL,QAAQ,EAAG,IAAI,CAAC,QAAQ;YACxB,KAAK,EAAM,IAAI,CAAC,KAAK;YACrB,KAAK,EAAM,IAAI,CAAC,KAAK;YACrB,GAAG,EAAQ,IAAI,CAAC,GAAG;YACnB,QAAQ,EAAG,IAAI,CAAC,QAAQ,IAAI,IAAI;SACjC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAA6B;QAC3C,OAAO,IAAI,UAAU,CACnB,IAAI,CAAC,UAAU,CAAW,EACzB,IAAI,CAAC,OAAO,CAAsB,IAAI,EAAE,EACxC,IAAI,CAAC,OAAO,CAAsB,IAAI,EAAE,EACzC,IAAI,CAAC,KAAK,CAAgB,EACzB,IAAI,CAAC,UAAU,CAAoC,IAAI,SAAS,CAClE,CAAC;IACJ,CAAC;CACF"}

package/dist/ndp/index.d.ts

@@ -2,4 +2,7 @@ export * from "./frames.js";
 export * from "./registry.js";
 export * from "./ndp-registry.js";
 export * from "./validator.js";
+export * from "./dns-txt.js";
+export * from "./ndp-error-codes.js";
+export * from "./security.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/ndp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ndp/index.ts"],"names":[],"mappings":"AAGA,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ndp/index.ts"],"names":[],"mappings":"AAGA,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC"}

package/dist/ndp/index.js

@@ -4,4 +4,7 @@ export * from "./frames.js";
 export * from "./registry.js";
 export * from "./ndp-registry.js";
 export * from "./validator.js";
+export * from "./dns-txt.js";
+export * from "./ndp-error-codes.js";
+export * from "./security.js";
 //# sourceMappingURL=index.js.map

package/dist/ndp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ndp/index.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,sCAAsC;AAEtC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ndp/index.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,sCAAsC;AAEtC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC"}

package/dist/ndp/ndp-error-codes.d.ts

@@ -0,0 +1,25 @@
+export declare const NDP_RESOLVE_NOT_FOUND: "NDP-RESOLVE-NOT-FOUND";
+export declare const NDP_RESOLVE_AMBIGUOUS: "NDP-RESOLVE-AMBIGUOUS";
+export declare const NDP_RESOLVE_TIMEOUT: "NDP-RESOLVE-TIMEOUT";
+export declare const NDP_ANNOUNCE_SIGNATURE_INVALID: "NDP-ANNOUNCE-SIGNATURE-INVALID";
+export declare const NDP_ANNOUNCE_NID_MISMATCH: "NDP-ANNOUNCE-NID-MISMATCH";
+/** NPS-CR-0001: legacy "gateway" role removed; use "anchor" or "bridge" */
+export declare const NDP_ANNOUNCE_ROLE_REMOVED: "NDP-ANNOUNCE-ROLE-REMOVED";
+export declare const NDP_ANNOUNCE_ROLE_UNKNOWN: "NDP-ANNOUNCE-ROLE-UNKNOWN";
+export declare const NDP_ANNOUNCE_CONFLICT: "NDP-ANNOUNCE-CONFLICT";
+export declare const NDP_GRAPH_SEQ_ROLLBACK: "NDP-GRAPH-SEQ-ROLLBACK";
+export declare const NDP_GRAPH_SEQ_GAP: "NDP-GRAPH-SEQ-GAP";
+export declare const NDP_ISSUER_NOT_ALLOWED: "NDP-ISSUER-NOT-ALLOWED";
+export declare const NDP_CA_ATTEST_REQUIRED: "NDP-CA-ATTEST-REQUIRED";
+export declare const NDP_REGISTRY_UNAVAILABLE: "NDP-REGISTRY-UNAVAILABLE";
+/** DAG graph structure is invalid */
+export declare const NDP_GRAPH_INVALID: "NDP-GRAPH-INVALID";
+/** DAG graph exceeds maximum permitted size */
+export declare const NDP_GRAPH_TOO_LARGE: "NDP-GRAPH-TOO-LARGE";
+/** Federation resolution resulted in a routing loop */
+export declare const NDP_FEDERATION_LOOP: "NDP-FEDERATION-LOOP";
+/** Announce not received within heartbeat_interval_ms × 3 dead-peer threshold (v0.9) */
+export declare const NDP_ANNOUNCE_STALE: "NDP-ANNOUNCE-STALE";
+/** Maps each NDP error code to its NPS status code. */
+export declare const NDP_ERROR_TO_NPS_STATUS: Record<string, string>;
+//# sourceMappingURL=ndp-error-codes.d.ts.map

package/dist/ndp/ndp-error-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ndp-error-codes.d.ts","sourceRoot":"","sources":["../../src/ndp/ndp-error-codes.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,qBAAqB,EAAW,uBAAgC,CAAC;AAC9E,eAAO,MAAM,qBAAqB,EAAW,uBAAgC,CAAC;AAC9E,eAAO,MAAM,mBAAmB,EAAa,qBAA8B,CAAC;AAC5E,eAAO,MAAM,8BAA8B,EAAG,gCAAyC,CAAC;AACxF,eAAO,MAAM,yBAAyB,EAAO,2BAAoC,CAAC;AAClF,2EAA2E;AAC3E,eAAO,MAAM,yBAAyB,EAAO,2BAAoC,CAAC;AAClF,eAAO,MAAM,yBAAyB,EAAO,2BAAoC,CAAC;AAClF,eAAO,MAAM,qBAAqB,EAAW,uBAAgC,CAAC;AAC9E,eAAO,MAAM,sBAAsB,EAAU,wBAAiC,CAAC;AAC/E,eAAO,MAAM,iBAAiB,EAAe,mBAA4B,CAAC;AAC1E,eAAO,MAAM,sBAAsB,EAAU,wBAAiC,CAAC;AAC/E,eAAO,MAAM,sBAAsB,EAAU,wBAAiC,CAAC;AAC/E,eAAO,MAAM,wBAAwB,EAAQ,0BAAmC,CAAC;AAGjF,qCAAqC;AACrC,eAAO,MAAM,iBAAiB,EAAe,mBAA4B,CAAC;AAC1E,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,EAAa,qBAA8B,CAAC;AAC5E,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,EAAa,qBAA8B,CAAC;AAC5E,wFAAwF;AACxF,eAAO,MAAM,kBAAkB,EAAc,oBAA6B,CAAC;AAE3E,uDAAuD;AACvD,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAkB1D,CAAC"}

package/dist/ndp/ndp-error-codes.js

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) 2026 LabAcacia / INNO LOTUS PTY LTD
+//
+// NDP Error Codes — all 13 protocol error codes per spec/error-codes.md
+export const NDP_RESOLVE_NOT_FOUND = "NDP-RESOLVE-NOT-FOUND";
+export const NDP_RESOLVE_AMBIGUOUS = "NDP-RESOLVE-AMBIGUOUS";
+export const NDP_RESOLVE_TIMEOUT = "NDP-RESOLVE-TIMEOUT";
+export const NDP_ANNOUNCE_SIGNATURE_INVALID = "NDP-ANNOUNCE-SIGNATURE-INVALID";
+export const NDP_ANNOUNCE_NID_MISMATCH = "NDP-ANNOUNCE-NID-MISMATCH";
+/** NPS-CR-0001: legacy "gateway" role removed; use "anchor" or "bridge" */
+export const NDP_ANNOUNCE_ROLE_REMOVED = "NDP-ANNOUNCE-ROLE-REMOVED";
+export const NDP_ANNOUNCE_ROLE_UNKNOWN = "NDP-ANNOUNCE-ROLE-UNKNOWN";
+export const NDP_ANNOUNCE_CONFLICT = "NDP-ANNOUNCE-CONFLICT";
+export const NDP_GRAPH_SEQ_ROLLBACK = "NDP-GRAPH-SEQ-ROLLBACK";
+export const NDP_GRAPH_SEQ_GAP = "NDP-GRAPH-SEQ-GAP";
+export const NDP_ISSUER_NOT_ALLOWED = "NDP-ISSUER-NOT-ALLOWED";
+export const NDP_CA_ATTEST_REQUIRED = "NDP-CA-ATTEST-REQUIRED";
+export const NDP_REGISTRY_UNAVAILABLE = "NDP-REGISTRY-UNAVAILABLE";
+// ── Referenced in task description (extra codes) ──────────────────────────────
+/** DAG graph structure is invalid */
+export const NDP_GRAPH_INVALID = "NDP-GRAPH-INVALID";
+/** DAG graph exceeds maximum permitted size */
+export const NDP_GRAPH_TOO_LARGE = "NDP-GRAPH-TOO-LARGE";
+/** Federation resolution resulted in a routing loop */
+export const NDP_FEDERATION_LOOP = "NDP-FEDERATION-LOOP";
+/** Announce not received within heartbeat_interval_ms × 3 dead-peer threshold (v0.9) */
+export const NDP_ANNOUNCE_STALE = "NDP-ANNOUNCE-STALE";
+/** Maps each NDP error code to its NPS status code. */
+export const NDP_ERROR_TO_NPS_STATUS = {
+    "NDP-RESOLVE-NOT-FOUND": "NPS-CLIENT-NOT-FOUND",
+    "NDP-RESOLVE-AMBIGUOUS": "NPS-CLIENT-CONFLICT",
+    "NDP-RESOLVE-TIMEOUT": "NPS-SERVER-TIMEOUT",
+    "NDP-ANNOUNCE-SIGNATURE-INVALID": "NPS-AUTH-UNAUTHENTICATED",
+    "NDP-ANNOUNCE-NID-MISMATCH": "NPS-CLIENT-BAD-FRAME",
+    "NDP-ANNOUNCE-ROLE-REMOVED": "NPS-CLIENT-BAD-FRAME",
+    "NDP-ANNOUNCE-ROLE-UNKNOWN": "NPS-CLIENT-BAD-FRAME",
+    "NDP-ANNOUNCE-CONFLICT": "NPS-CLIENT-CONFLICT",
+    "NDP-GRAPH-SEQ-ROLLBACK": "NPS-CLIENT-BAD-FRAME",
+    "NDP-GRAPH-SEQ-GAP": "NPS-STREAM-SEQ-GAP",
+    "NDP-ISSUER-NOT-ALLOWED": "NPS-AUTH-FORBIDDEN",
+    "NDP-CA-ATTEST-REQUIRED": "NPS-AUTH-UNAUTHENTICATED",
+    "NDP-REGISTRY-UNAVAILABLE": "NPS-SERVER-UNAVAILABLE",
+    "NDP-GRAPH-INVALID": "NPS-CLIENT-BAD-FRAME",
+    "NDP-GRAPH-TOO-LARGE": "NPS-LIMIT-PAYLOAD",
+    "NDP-FEDERATION-LOOP": "NPS-CLIENT-CONFLICT",
+    "NDP-ANNOUNCE-STALE": "NPS-CLIENT-NOT-FOUND",
+};
+//# sourceMappingURL=ndp-error-codes.js.map

package/dist/ndp/ndp-error-codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ndp-error-codes.js","sourceRoot":"","sources":["../../src/ndp/ndp-error-codes.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,oDAAoD;AACpD,EAAE;AACF,wEAAwE;AAExE,MAAM,CAAC,MAAM,qBAAqB,GAAW,uBAAgC,CAAC;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAW,uBAAgC,CAAC;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAa,qBAA8B,CAAC;AAC5E,MAAM,CAAC,MAAM,8BAA8B,GAAG,gCAAyC,CAAC;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAO,2BAAoC,CAAC;AAClF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAO,2BAAoC,CAAC;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAO,2BAAoC,CAAC;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAW,uBAAgC,CAAC;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAU,wBAAiC,CAAC;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAe,mBAA4B,CAAC;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAU,wBAAiC,CAAC;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAU,wBAAiC,CAAC;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAQ,0BAAmC,CAAC;AAEjF,iFAAiF;AACjF,qCAAqC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAe,mBAA4B,CAAC;AAC1E,+CAA+C;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAAa,qBAA8B,CAAC;AAC5E,uDAAuD;AACvD,MAAM,CAAC,MAAM,mBAAmB,GAAa,qBAA8B,CAAC;AAC5E,wFAAwF;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAAc,oBAA6B,CAAC;AAE3E,uDAAuD;AACvD,MAAM,CAAC,MAAM,uBAAuB,GAA2B;IAC7D,uBAAuB,EAAW,sBAAsB;IACxD,uBAAuB,EAAW,qBAAqB;IACvD,qBAAqB,EAAa,oBAAoB;IACtD,gCAAgC,EAAE,0BAA0B;IAC5D,2BAA2B,EAAO,sBAAsB;IACxD,2BAA2B,EAAO,sBAAsB;IACxD,2BAA2B,EAAO,sBAAsB;IACxD,uBAAuB,EAAW,qBAAqB;IACvD,wBAAwB,EAAU,sBAAsB;IACxD,mBAAmB,EAAe,oBAAoB;IACtD,wBAAwB,EAAU,oBAAoB;IACtD,wBAAwB,EAAU,0BAA0B;IAC5D,0BAA0B,EAAQ,wBAAwB;IAC1D,mBAAmB,EAAe,sBAAsB;IACxD,qBAAqB,EAAa,mBAAmB;IACrD,qBAAqB,EAAa,qBAAqB;IACvD,oBAAoB,EAAc,sBAAsB;CACzD,CAAC"}

package/dist/ndp/ndp-registry.d.ts

@@ -1,4 +1,5 @@
 import type { AnnounceFrame, NdpResolveResult } from "./frames.js";
+import { type DnsTxtLookup } from "./dns-txt.js";
 export declare class InMemoryNdpRegistry {
     private readonly _store;
     clock: () => number;
@@ -6,6 +7,7 @@ export declare class InMemoryNdpRegistry {
     getByNid(nid: string): AnnounceFrame | undefined;
     resolve(target: string): NdpResolveResult | undefined;
     getAll(): AnnounceFrame[];
+    resolveWithDns(target: string, resolver?: DnsTxtLookup): Promise<NdpResolveResult | undefined>;
     static nwpTargetMatchesNid(nid: string, target: string): boolean;
 }
 //# sourceMappingURL=ndp-registry.d.ts.map

package/dist/ndp/ndp-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ndp-registry.d.ts","sourceRoot":"","sources":["../../src/ndp/ndp-registry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAOnE,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAG3D,KAAK,EAAE,MAAM,MAAM,CAAoB;IAEvC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI;IASpC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAUhD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAWrD,MAAM,IAAI,aAAa,EAAE;IAUzB,MAAM,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;CAyBjE"}
+{"version":3,"file":"ndp-registry.d.ts","sourceRoot":"","sources":["../../src/ndp/ndp-registry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAOtB,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAG3D,KAAK,EAAE,MAAM,MAAM,CAAoB;IAEvC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI;IASpC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAUhD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAWrD,MAAM,IAAI,aAAa,EAAE;IAUnB,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,YAAuC,GAChD,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAyBxC,MAAM,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;CAyBjE"}

package/dist/ndp/ndp-registry.js

@@ -1,5 +1,6 @@
 // Copyright 2026 INNO LOTUS PTY LTD
 // SPDX-License-Identifier: Apache-2.0
+import { extractHostFromTarget, parseNpsTxtRecord, SystemDnsTxtLookup, } from "./dns-txt.js";
 export class InMemoryNdpRegistry {
     _store = new Map();
     // Replaceable for testing
@@ -49,6 +50,30 @@ export class InMemoryNdpRegistry {
         }
         return result;
     }
+    async resolveWithDns(target, resolver = new SystemDnsTxtLookup()) {
+        // 1. Try in-memory registry first
+        const cached = this.resolve(target);
+        if (cached !== undefined)
+            return cached;
+        // 2. Extract hostname and fall back to DNS TXT lookup
+        const host = extractHostFromTarget(target);
+        if (host === undefined)
+            return undefined;
+        const txtHost = `_nps-node.${host}`;
+        let records;
+        try {
+            records = await resolver.resolveTxt(txtHost);
+        }
+        catch {
+            return undefined;
+        }
+        for (const record of records) {
+            const result = parseNpsTxtRecord(record, host);
+            if (result !== undefined)
+                return result;
+        }
+        return undefined;
+    }
     static nwpTargetMatchesNid(nid, target) {
         // NID: urn:nps:node:{authority}:{path-segment}
         // target: nwp://{authority}/{path}

package/dist/ndp/ndp-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"ndp-registry.js","sourceRoot":"","sources":["../../src/ndp/ndp-registry.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,sCAAsC;AAStC,MAAM,OAAO,mBAAmB;IACb,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE3D,0BAA0B;IAC1B,KAAK,GAAiB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvC,QAAQ,CAAC,KAAoB;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;QAClD,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1E,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC;gBAAE,SAAS;YACpE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YACjC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM;QACJ,MAAM,GAAG,GAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,mBAAmB,CAAC,GAAW,EAAE,MAAc;QACpD,+CAA+C;QAC/C,mCAAmC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACpG,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAE/C,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAClC,MAAM,OAAO,GAAQ,QAAQ,CAAC,CAAC,CAAE,CAAC;QAClC,MAAM,IAAI,GAAW,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAElC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,wBAAwB;QAEvE,IAAI,YAAY,KAAK,YAAY;YAAE,OAAO,KAAK,CAAC;QAEhD,4DAA4D;QAC5D,IAAI,OAAO,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"ndp-registry.js","sourceRoot":"","sources":["../../src/ndp/ndp-registry.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,sCAAsC;AAGtC,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,cAAc,CAAC;AAOtB,MAAM,OAAO,mBAAmB;IACb,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE3D,0BAA0B;IAC1B,KAAK,GAAiB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvC,QAAQ,CAAC,KAAoB;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;QAClD,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1E,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC;gBAAE,SAAS;YACpE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YACjC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM;QACJ,MAAM,GAAG,GAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAyB,IAAI,kBAAkB,EAAE;QAEjD,kCAAkC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QAExC,sDAAsD;QACtD,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAEzC,MAAM,OAAO,GAAG,aAAa,IAAI,EAAE,CAAC;QACpC,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC;QAC1C,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,mBAAmB,CAAC,GAAW,EAAE,MAAc;QACpD,+CAA+C;QAC/C,mCAAmC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACpG,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAE/C,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAClC,MAAM,OAAO,GAAQ,QAAQ,CAAC,CAAC,CAAE,CAAC;QAClC,MAAM,IAAI,GAAW,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAElC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,wBAAwB;QAEvE,IAAI,YAAY,KAAK,YAAY;YAAE,OAAO,KAAK,CAAC;QAEhD,4DAA4D;QAC5D,IAAI,OAAO,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/ndp/security.d.ts

@@ -0,0 +1,8 @@
+/** NDP security profile constants (NPS-4 §7.2) */
+export declare const SecurityProfile: {
+    readonly LOCAL_DEV: "local-dev";
+    readonly ORG_PRIVATE: "org-private";
+    readonly PUBLIC_FEDERATED: "public-federated";
+};
+export type SecurityProfileValue = typeof SecurityProfile[keyof typeof SecurityProfile];
+//# sourceMappingURL=security.d.ts.map

package/dist/ndp/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/ndp/security.ts"],"names":[],"mappings":"AAGA,kDAAkD;AAClD,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC"}

package/dist/ndp/security.js

@@ -0,0 +1,9 @@
+// Copyright 2026 INNO LOTUS PTY LTD
+// SPDX-License-Identifier: Apache-2.0
+/** NDP security profile constants (NPS-4 §7.2) */
+export const SecurityProfile = {
+    LOCAL_DEV: 'local-dev',
+    ORG_PRIVATE: 'org-private',
+    PUBLIC_FEDERATED: 'public-federated',
+};
+//# sourceMappingURL=security.js.map

package/dist/ndp/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/ndp/security.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,sCAAsC;AAEtC,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,SAAS,EAAS,WAAW;IAC7B,WAAW,EAAO,aAAa;IAC/B,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC"}

package/dist/nip/acme/client.d.ts

@@ -0,0 +1,31 @@
+export interface AcmeClientOptions {
+    /** ACME directory URL. */
+    directoryUrl: string;
+    /** Account/agent Ed25519 private key (32-byte raw). */
+    privateKey: Uint8Array;
+    /** Account/agent Ed25519 public key (32-byte raw). */
+    publicKey: Uint8Array;
+    /** Web Crypto Ed25519 keypair for CSR signing (must match privateKey). */
+    webCryptoKeys: CryptoKeyPair;
+}
+export declare class AcmeClient {
+    readonly options: AcmeClientOptions;
+    private directory;
+    private accountUrl;
+    private lastNonce;
+    constructor(options: AcmeClientOptions);
+    /** Drive the full agent-01 flow for `nid`. Returns issued PEM cert chain. */
+    issueAgentCert(nid: string): Promise<string>;
+    private ensureDirectory;
+    private refreshNonce;
+    private newAccount;
+    private newOrder;
+    private fetchAuthz;
+    private respondAgent01;
+    private finalizeOrder;
+    private downloadPem;
+    private post;
+    private captureNonce;
+    private buildCsr;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/nip/acme/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/nip/acme/client.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,iBAAiB;IAChC,0BAA0B;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,UAAU,EAAI,UAAU,CAAC;IACzB,sDAAsD;IACtD,SAAS,EAAK,UAAU,CAAC;IACzB,0EAA0E;IAC1E,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,qBAAa,UAAU;aAKO,OAAO,EAAE,iBAAiB;IAJtD,OAAO,CAAC,SAAS,CAA2B;IAC5C,OAAO,CAAC,UAAU,CAA0B;IAC5C,OAAO,CAAC,SAAS,CAA2B;gBAEhB,OAAO,EAAE,iBAAiB;IAEtD,6EAA6E;IACvE,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAYpC,eAAe;YAQf,YAAY;YASZ,UAAU;YAcV,QAAQ;YAcR,UAAU;YAYV,cAAc;YAiBd,aAAa;YAYb,WAAW;YAaX,IAAI;IAQlB,OAAO,CAAC,YAAY;YAKN,QAAQ;CAWvB"}

package/dist/nip/acme/client.js

@@ -0,0 +1,136 @@
+// Copyright 2026 INNO LOTUS PTY LTD
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * ACME client implementing the `agent-01` challenge type per NPS-RFC-0002 §4.4.
+ *
+ * Flow: newNonce → newAccount → newOrder → fetch authz → sign challenge token →
+ * finalize with CSR → fetch leaf cert.
+ */
+import * as ed25519 from "@noble/ed25519";
+import { sha512 } from "@noble/hashes/sha512";
+import * as x509 from "@peculiar/x509";
+import * as Jws from "./jws.js";
+import * as wire from "./wire.js";
+ed25519.etc.sha512Sync = (...m) => sha512(ed25519.etc.concatBytes(...m));
+x509.cryptoProvider.set(globalThis.crypto);
+export class AcmeClient {
+    options;
+    directory = null;
+    accountUrl = null;
+    lastNonce = null;
+    constructor(options) {
+        this.options = options;
+    }
+    /** Drive the full agent-01 flow for `nid`. Returns issued PEM cert chain. */
+    async issueAgentCert(nid) {
+        await this.ensureDirectory();
+        if (this.accountUrl === null)
+            await this.newAccount();
+        const order = await this.newOrder(nid);
+        const authz = await this.fetchAuthz(order.authorizations[0]);
+        await this.respondAgent01(authz);
+        const finalized = await this.finalizeOrder(order, nid);
+        return this.downloadPem(finalized.certificate);
+    }
+    // ── Stages ───────────────────────────────────────────────────────────────
+    async ensureDirectory() {
+        if (this.directory !== null)
+            return;
+        const resp = await fetch(this.options.directoryUrl);
+        ensureSuccess(resp);
+        this.directory = await resp.json();
+        await this.refreshNonce();
+    }
+    async refreshNonce() {
+        const resp = await fetch(this.directory.newNonce, { method: "HEAD" });
+        ensureSuccess(resp);
+        this.lastNonce = resp.headers.get("Replay-Nonce");
+        if (this.lastNonce === null) {
+            throw new Error("server omitted Replay-Nonce");
+        }
+    }
+    async newAccount() {
+        const jwk = Jws.jwkFromPublicKey(this.options.publicKey);
+        const env = Jws.sign({ alg: Jws.ALG_EDDSA, nonce: this.lastNonce, url: this.directory.newAccount, jwk }, { termsOfServiceAgreed: true }, this.options.privateKey);
+        const resp = await this.post(this.directory.newAccount, env);
+        ensureSuccess(resp);
+        this.accountUrl = resp.headers.get("Location");
+        if (this.accountUrl === null)
+            throw new Error("server omitted account Location");
+        this.captureNonce(resp);
+    }
+    async newOrder(nid) {
+        const env = Jws.sign({ alg: Jws.ALG_EDDSA, nonce: this.lastNonce, url: this.directory.newOrder, kid: this.accountUrl }, {
+            identifiers: [{ type: wire.IDENTIFIER_TYPE_NID, value: nid }],
+        }, this.options.privateKey);
+        const resp = await this.post(this.directory.newOrder, env);
+        ensureSuccess(resp);
+        this.captureNonce(resp);
+        return await resp.json();
+    }
+    async fetchAuthz(url) {
+        // POST-as-GET (RFC 8555 §6.3).
+        const env = Jws.sign({ alg: Jws.ALG_EDDSA, nonce: this.lastNonce, url, kid: this.accountUrl }, null, this.options.privateKey);
+        const resp = await this.post(url, env);
+        ensureSuccess(resp);
+        this.captureNonce(resp);
+        return await resp.json();
+    }
+    async respondAgent01(authz) {
+        const challenge = authz.challenges.find((c) => c.type === wire.CHALLENGE_AGENT_01);
+        if (!challenge)
+            throw new Error("authz has no agent-01 challenge");
+        // Sign the challenge token with the account/NID private key.
+        const tokenBytes = new TextEncoder().encode(challenge.token);
+        const sig = ed25519.sign(tokenBytes, this.options.privateKey);
+        const env = Jws.sign({ alg: Jws.ALG_EDDSA, nonce: this.lastNonce, url: challenge.url, kid: this.accountUrl }, { agent_signature: Jws.b64uEncode(sig) }, this.options.privateKey);
+        const resp = await this.post(challenge.url, env);
+        ensureSuccess(resp);
+        this.captureNonce(resp);
+    }
+    async finalizeOrder(order, nid) {
+        const csrDer = await this.buildCsr(nid);
+        const env = Jws.sign({ alg: Jws.ALG_EDDSA, nonce: this.lastNonce, url: order.finalize, kid: this.accountUrl }, { csr: Jws.b64uEncode(csrDer) }, this.options.privateKey);
+        const resp = await this.post(order.finalize, env);
+        ensureSuccess(resp);
+        this.captureNonce(resp);
+        return await resp.json();
+    }
+    async downloadPem(certUrl) {
+        const env = Jws.sign({ alg: Jws.ALG_EDDSA, nonce: this.lastNonce, url: certUrl, kid: this.accountUrl }, null, this.options.privateKey);
+        const resp = await this.post(certUrl, env);
+        ensureSuccess(resp);
+        this.captureNonce(resp);
+        return await resp.text();
+    }
+    // ── helpers ──────────────────────────────────────────────────────────────
+    async post(url, env) {
+        return await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": wire.CONTENT_TYPE_JOSE_JSON },
+            body: JSON.stringify(env),
+        });
+    }
+    captureNonce(resp) {
+        const nonce = resp.headers.get("Replay-Nonce");
+        if (nonce !== null)
+            this.lastNonce = nonce;
+    }
+    async buildCsr(nid) {
+        const csr = await x509.Pkcs10CertificateRequestGenerator.create({
+            name: `CN=${nid.replace(/([",+;<>\\])/g, "\\$1")}`,
+            keys: this.options.webCryptoKeys,
+            signingAlgorithm: { name: "Ed25519" },
+            extensions: [
+                new x509.SubjectAlternativeNameExtension([{ type: "url", value: nid }], false),
+            ],
+        });
+        return new Uint8Array(csr.rawData);
+    }
+}
+function ensureSuccess(resp) {
+    if (!resp.ok) {
+        throw new Error(`ACME ${resp.url} HTTP ${resp.status}`);
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/nip/acme/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/nip/acme/client.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,sCAAsC;AAEtC;;;;;GAKG;AAEH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,IAAI,MAAM,gBAAgB,CAAC;AAEvC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAKhC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACzE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAa3C,MAAM,OAAO,UAAU;IAKO;IAJpB,SAAS,GAAsB,IAAI,CAAC;IACpC,UAAU,GAAqB,IAAI,CAAC;IACpC,SAAS,GAAsB,IAAI,CAAC;IAE5C,YAA4B,OAA0B;QAA1B,YAAO,GAAP,OAAO,CAAmB;IAAG,CAAC;IAE1D,6EAA6E;IAC7E,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,WAAY,CAAC,CAAC;IAClD,CAAC;IAED,4EAA4E;IAEpE,KAAK,CAAC,eAAe;QAC3B,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO;QACpC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACpD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAe,CAAC;QAChD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAU,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAClB,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,SAAU,EAAE,GAAG,EAAE,IAAI,CAAC,SAAU,CAAC,UAAU,EAAE,GAAG,EAAE,EACpF,EAAE,oBAAoB,EAAE,IAAI,EAAuB,EACnD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC9D,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACjF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAW;QAChC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAClB,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,SAAU,EAAE,GAAG,EAAE,IAAI,CAAC,SAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,UAAW,EAAE,EACpG;YACE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAgB,CAAC;SACzD,EACpB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5D,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,MAAM,IAAI,CAAC,IAAI,EAAW,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,GAAW;QAClC,+BAA+B;QAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAClB,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,SAAU,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,UAAW,EAAE,EAC1E,IAAI,EACJ,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,MAAM,IAAI,CAAC,IAAI,EAAmB,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,KAAoB;QAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnF,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAEnE,6DAA6D;QAC7D,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAClB,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,SAAU,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,UAAW,EAAE,EACzF,EAAE,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EACxC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,KAAY,EAAE,GAAW;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAClB,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,SAAU,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,UAAW,EAAE,EAC1F,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAqB,EAClD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,MAAM,IAAI,CAAC,IAAI,EAAW,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,OAAe;QACvC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAClB,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,SAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,UAAW,EAAE,EACnF,IAAI,EACJ,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC3C,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,4EAA4E;IAEpE,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,GAAiB;QAC/C,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE;YACtB,MAAM,EAAG,MAAM;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,sBAAsB,EAAE;YACxD,IAAI,EAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAAC,IAAc;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,IAAI;YAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;IAC7C,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAW;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;YAC9D,IAAI,EAAE,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE;YAClD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;YAChC,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACrC,UAAU,EAAE;gBACV,IAAI,IAAI,CAAC,+BAA+B,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC;aAC/E;SACF,CAAC,CAAC;QACH,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;CACF;AAED,SAAS,aAAa,CAAC,IAAc;IACnC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,GAAG,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}

package/dist/nip/acme/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./client.js";
+export * from "./jws.js";
+export * from "./messages.js";
+export * from "./server.js";
+export * from "./wire.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/nip/acme/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nip/acme/index.ts"],"names":[],"mappings":"AAGA,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC"}

package/dist/nip/acme/index.js

@@ -0,0 +1,8 @@
+// Copyright 2026 INNO LOTUS PTY LTD
+// SPDX-License-Identifier: Apache-2.0
+export * from "./client.js";
+export * from "./jws.js";
+export * from "./messages.js";
+export * from "./server.js";
+export * from "./wire.js";
+//# sourceMappingURL=index.js.map

package/dist/nip/acme/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nip/acme/index.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,sCAAsC;AAEtC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC"}

package/dist/nip/acme/jws.d.ts

@@ -0,0 +1,31 @@
+export declare const ALG_EDDSA = "EdDSA";
+export declare const KTY_OKP = "OKP";
+export declare const CRV_ED25519 = "Ed25519";
+export interface Jwk {
+    kty: string;
+    crv: string;
+    x: string;
+}
+export interface ProtectedHeader {
+    alg: string;
+    nonce: string;
+    url: string;
+    jwk?: Jwk;
+    kid?: string;
+}
+export interface Envelope {
+    protected: string;
+    payload: string;
+    signature: string;
+}
+export declare function jwkFromPublicKey(rawPubKey: Uint8Array): Jwk;
+export declare function publicKeyFromJwk(jwk: Jwk): Uint8Array;
+/** RFC 7638 §3 thumbprint of an Ed25519 JWK (lex-sorted compact JSON, SHA-256, base64url). */
+export declare function thumbprint(jwk: Jwk): string;
+export declare function sign(header: ProtectedHeader, payload: unknown | null, privKey: Uint8Array): Envelope;
+/** Verify a JWS envelope. Returns the parsed protected header on success, else null. */
+export declare function verify(envelope: Envelope, pubKey: Uint8Array): ProtectedHeader | null;
+export declare function decodePayload<T = unknown>(envelope: Envelope): T | null;
+export declare function b64uEncode(bytes: Uint8Array): string;
+export declare function b64uDecode(s: string): Uint8Array;
+//# sourceMappingURL=jws.d.ts.map

package/dist/nip/acme/jws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jws.d.ts","sourceRoot":"","sources":["../../../src/nip/acme/jws.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,SAAS,UAAY,CAAC;AACnC,eAAO,MAAM,OAAO,QAAY,CAAC;AACjC,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,EAAI,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAK,MAAM,CAAC;IACf,KAAK,EAAG,MAAM,CAAC;IACf,GAAG,EAAK,MAAM,CAAC;IACf,GAAG,CAAC,EAAI,GAAG,CAAC;IACZ,GAAG,CAAC,EAAI,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAI,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,UAAU,GAAG,GAAG,CAK3D;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,GAAG,UAAU,CAKrD;AAED,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAG3C;AAED,wBAAgB,IAAI,CAClB,MAAM,EAAI,eAAe,EACzB,OAAO,EAAG,OAAO,GAAG,IAAI,EACxB,OAAO,EAAG,UAAU,GACnB,QAAQ,CASV;AAED,wFAAwF;AACxF,wBAAgB,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,GAAG,eAAe,GAAG,IAAI,CAUrF;AAED,wBAAgB,aAAa,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,CAAC,GAAG,IAAI,CAGvE;AAID,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGpD;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAIhD"}